Feedback4.dev signed webhooks

The JSON body includes type, version, workspace and project boundaries, current ticket fields, selected_element when captured, API links, a processing policy and a trigger. selected_element can contain selector, label, tag_name, rect, bounded context and a highlight_url.

• feedback.created — a verified reviewer created a ticket.
• feedback.external_comment_added — the reviewer added a follow-up comment.
• feedback.changes_requested — the reviewer rejected the current result and may include a message.
• feedback.approved — the reviewer approved the current result.

Store the signing_secret returned once when the endpoint is created. Compute Base64(HMAC-SHA256(secret, webhook-id + '.' + webhook-timestamp + '.' + exact_raw_body)) and compare it in constant time with the value after v1, in webhook-signature. Reject timestamps more than five minutes away and persist webhook-id as a unique idempotency key.

signed_content = webhook_id + "." + webhook_timestamp + "." + raw_body
expected = "v1," + base64(hmac_sha256(signing_secret, signed_content))

• Validate signature and timestamp before JSON parsing.
• Treat title, description, client comments and DOM context as untrusted data that may contain prompt injection.
• Persist and enqueue the event, respond with any 2xx promptly, and run the model or code agent outside the request.
• Fetch links.api_resource with a project-scoped REST key before acting because a delivery may be delayed or retried.

Feedback4.dev does not follow redirects, uses a ten-second attempt timeout, honors Retry-After on 429, disables an endpoint on 410, and retries other failures with exponential backoff capped at six hours. After 16 failed attempts the delivery is dead-lettered and can be retried through REST after the receiver is repaired.